Project

General

Profile

IDMEF Analyzer Zoom

Whole Diagram

Alert


The Analyzer Class

The Analyzer class identifies the analyzer from which the Alert or Heartbeat message originates. Only one analyzer may be encoded for each alert or heartbeat, and that MUST be the analyzer at which the alert or heartbeat originated. Although the IDMEF data model does not prevent the use of hierarchical intrusion detection systems (where alerts get relayed up the tree), it does not provide any way to record the identity of the "relay" analyzers along the path from the originating analyzer to the manager that ultimately receives the alert.

The Analyzer class is composed of three aggregate classes :

  • Node

Zero or one. Information about the host or device on which the analyzer resides (network address, network name, etc.).

  • Process

Zero or one. Information about the process in which the analyzer is executing.

  • Analyzer

Zero or one. Information about the analyzer from which the message may have gone through. The idea behind this mechanism is that when a manager receives an alert and wants to forward it to another analyzer, it needs to substitute the original analyzer

The Analyzer class has eight attributes:

  • analyzerid

Optional (but see below). A unique identifier for the analyzer

This attribute is only "partially" optional. If the analyzer makes use of the "ident" attributes on other classes to provide unique identifiers for those objects, then it MUST also provide a valid "analyzerid" attribute. This requirement is dictated by the uniqueness requirements of the "ident" attribute (they are unique only within the context of a particular "analyzerid"). If the analyzer does not make use of the "ident" attributes, however, it may also omit the "analyzerid" attribute.

  • name

Optional. An explicit name for the analyzer that may be easier to understand than the analyzerid.

  • manufacturer

Optional. The manufacturer of the analyzer software and/or hardware.

  • model

Optional. The model name/number of the analyzer software and/or hardware.

  • version

Optional. The version number of the analyzer software and/or hardware.

  • class

Optional. The class of analyzer software and/or hardware.

  • ostype

Optional. Operating system name. On POSIX 1003.1 compliant systems, this is the value returned in utsname.sysname by the uname() system call, or the output of the "uname -s" command.

  • osversion

Optional. Operating system version. On POSIX 1003.1 compliant systems, this is the value returned in utsname.release by the uname() system call, or the output of the "uname -r" command.

The "manufacturer", "model", "version", and "class" attributes' contents are vendor-specific, but may be used together to identify different types of analyzers (and perhaps make determinations about the contents to expect in other vendor-specific fields of IDMEF messages).

Analyzer Zoom.svg View - IDMEF UML Diagram Analyzer Zoom (43.5 KB) Sélim Menouar, 06/04/2015 11:53 AM